safemessaging.org Open in urlscan Pro
52.206.210.25  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set 815320e8-9676-4901-ba76-722eff02ef3f Show response safemessaging.org/landing/form/	4 KB 2 KB	458ms 378ms	Document text/html	52.206.210.25 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL http://safemessaging.org/landing/form/815320e8-9676-4901-ba76-722eff02ef3f Protocol HTTP/1.1 Server 52.206.210.25 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-206-210-25.compute-1.amazonaws.com Software nginx / Resource Hash 05637120824c87e485c578bb90cbf3af6e0d6fc36bac3707bf7e03aed8004098 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Host safemessaging.org Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 30 Jul 2021 21:05:22 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Server nginx X-Frame-Options SAMEORIGIN Referrer-Policy unsafe-url Set-Cookie csrf=58cbdf426e5169f97b80937d2721d51a89af133e1d3d81a0662a2365; path=/; secure X-XSS-Protection 1; mode=block X-Content-Type-Options nosniff Strict-Transport-Security max-age=63072000; includeSubDomains Content-Encoding gzip
GET H/1.1	200 OK	data-entry.28fd3fcdd108af61.css safemessaging.org/css/	3 KB 4 KB	125ms 125ms	Stylesheet text/css	52.206.210.25 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL http://safemessaging.org/css/data-entry.28fd3fcdd108af61.css Requested by Host: safemessaging.org URL: http://safemessaging.org/landing/form/815320e8-9676-4901-ba76-722eff02ef3f Protocol HTTP/1.1 Server 52.206.210.25 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-206-210-25.compute-1.amazonaws.com Software nginx / Resource Hash 118f737bd7e1c92f1ced69e9e628f2e4728094d02e7c225089a7e7bdeabd76cc Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Pragma no-cache Accept-Encoding gzip, deflate Host safemessaging.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://safemessaging.org/landing/form/815320e8-9676-4901-ba76-722eff02ef3f Connection keep-alive Cache-Control no-cache Referer http://safemessaging.org/landing/form/815320e8-9676-4901-ba76-722eff02ef3f User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 30 Jul 2021 21:05:22 GMT X-Content-Type-Options nosniff Last-Modified Fri, 30 Jul 2021 20:18:06 GMT Server nginx ETag "61045e7e-db8" Strict-Transport-Security max-age=63072000; includeSubDomains Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 3512 X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	delta-logo.svg s3.amazonaws.com/securityiq/phishing-templates/	2 KB 3 KB	523ms 148ms	Image image/svg+xml	52.217.161.56 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s3.amazonaws.com/securityiq/phishing-templates/delta-logo.svg Requested by Host: safemessaging.org URL: http://safemessaging.org/landing/form/815320e8-9676-4901-ba76-722eff02ef3f Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.161.56 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash c5cf23f3074399c8e0e9d1f641b6d89b6e1c386e68d5bf3e8c9aaa451c85f136 Request headers Referer http://safemessaging.org/landing/form/815320e8-9676-4901-ba76-722eff02ef3f User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 30 Jul 2021 21:05:23 GMT Last-Modified Tue, 04 Sep 2018 14:40:43 GMT Server AmazonS3 x-amz-request-id PWTRVDAVTSY9SHNQ ETag "cf28efa4e2a0b0e124631e87e3e82671" Content-Type image/svg+xml Accept-Ranges bytes Content-Length 2211 x-amz-id-2 P4ZWQRA0q9glaBvRWJtFtPCB0YOJbhoCEN2mZCH9RARxL0YS54L52OXoCg/QqzipfD8PjY9uYv8=
GET H/1.1	200 OK	delta-background.jpg s3.amazonaws.com/securityiq/phishing-templates/	86 KB 86 KB	537ms 165ms	Image image/jpeg	52.217.161.56 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s3.amazonaws.com/securityiq/phishing-templates/delta-background.jpg Requested by Host: safemessaging.org URL: http://safemessaging.org/landing/form/815320e8-9676-4901-ba76-722eff02ef3f Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.161.56 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash 958c86dfd3950c9d757dd9888ab40b5fc22fba80b9ecfe4ec646ed09ac7fa1e9 Request headers Referer http://safemessaging.org/landing/form/815320e8-9676-4901-ba76-722eff02ef3f User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 30 Jul 2021 21:05:23 GMT Last-Modified Tue, 04 Sep 2018 14:31:08 GMT Server AmazonS3 x-amz-request-id PWTM4FAW6MBMSK66 ETag "46d22d7a77eb0eda25f50f1a3091f7ec" Content-Type image/jpeg Accept-Ranges bytes Content-Length 88124 x-amz-id-2 ITVcMwuAuj1dTXzlLJZunCEm+DVyVXXtw1ZrMQPwnsoFsbXvSXhAtCZ2+l6BS6GkDdV5GoYLdr4=

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Delta (Transportation)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

s3.amazonaws.com
safemessaging.org
52.206.210.25
52.217.161.56
05637120824c87e485c578bb90cbf3af6e0d6fc36bac3707bf7e03aed8004098
118f737bd7e1c92f1ced69e9e628f2e4728094d02e7c225089a7e7bdeabd76cc
958c86dfd3950c9d757dd9888ab40b5fc22fba80b9ecfe4ec646ed09ac7fa1e9
c5cf23f3074399c8e0e9d1f641b6d89b6e1c386e68d5bf3e8c9aaa451c85f136